A flaw was found in sequoia-openpgp. (CVE-2026-42784)

CVE-2026-42784 is a cryptographic integrity vulnerability in the sequoia-openpgp library caused by incorrect inference of key flags for older certificates lacking a key flags subpacket. This discrepancy allows attackers to bypass the back-signature verification process, enabling them to bind arbitrary subkeys to their own certificates and forge signatures. The flaw compromises the cryptographic trust model of OpenPGP keys. Red Hat has issued multiple security advisories providing patches for affected packages, including rust-podman-sequoia and rust-rpm-sequoia, across various architectures and Red Hat Enterprise Linux 9 variants.

The vulnerability allows attackers to bypass critical cryptographic checks, specifically the back-signature verification, enabling them to illegitimately bind subkeys and forge signatures. This results in a complete compromise of cryptographic integrity for affected OpenPGP keys, potentially undermining trust in signed data and communications relying on these keys. The CVSS 3.1 base score is 7.4 (High), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope change, no confidentiality impact, high integrity impact, and no availability impact.

Official patches are available from Red Hat and should be applied promptly. Red Hat has released updates for rust-podman-sequoia and rust-rpm-sequoia packages in Red Hat Hardened Images and Red Hat Enterprise Linux 9 distributions. Users should apply these updates as detailed in the Red Hat advisories RHSA-2026:42902, RHSA-2026:76733, and RHSA-2026:76734. No additional mitigation actions are indicated by the vendor advisory.